1

On a Debian machine I was having problems connecting to a openVPN server.

The connection could be established, merely in the sense of that an interface would be added and that I would get a 10.130.x.x IP assigned to it, but I could not get any traffic accross the VPN. All traffic would still go over my original public IP address:

root@vps2:~# route -n  
Kernel IP routing table  
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface  
92.222.32.0     0.0.0.0         255.255.255.0   U     0      0        0 venet0  
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 venet0  
root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo  
92.222.32.42  
root@vps2:~# service openvpn start  
[ ok ] Starting virtual private network daemon: myvpn.  
root@vps2:~# route -n  
Kernel IP routing table  
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface  
10.130.3.137    0.0.0.0         255.255.255.255 UH    0      0        0 tun0  
92.222.32.0     0.0.0.0         255.255.255.0   U     0      0        0 venet0  
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 venet0  
root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo  
92.222.32.42  
root@vps2:~#   

In my syslog I was able to see the message NOTE: unable to redirect default gateway -- Cannot read current default gateway from system. And some searching led me to find that this was because the default gateway was not set explicitly. I guess the remote VPN is using some kind of client script that does not just expects to find a default gateway set explicitly.

I have tried 2 ways to set my default gateway explicitly. And both work!

  • First I tried setting my original public IP address as the default gateway, which worked:

    route add default gw 92.222.32.42  
    root@vps2:~# route add default gw 92.222.32.42  
    root@vps2:~# route -n  
    Kernel IP routing table  
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface  
    92.222.32.0     0.0.0.0         255.255.255.0   U     0      0        0 venet0  
    0.0.0.0         92.222.32.42    0.0.0.0         UG    0      0        0 venet0  
    0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 venet0  
    root@vps2:~# service openvpn start  
    [ ok ] Starting virtual private network daemon: myvpn.  
    root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo  
    217.23.15.239  
    root@vps2:~#   
    
  • But why use my original public IP as the default gateway? I don't know. So I also tried it by setting the first hop from a random traceroute as the default gateway. And that also worked:

    root@vps2:~# traceroute foo.com  
    traceroute to foo.com (121.232.122.233), 30 hops max, 60 byte packets  
     1  49.ip-92-222-50.eu (92.222.50.49)  0.039 ms  0.011 ms  0.012 ms  
     2  [......... I stop the traceroute when I see the first hop]  
     ^C  
    root@vps2:~# route add default gw 92.222.50.49
    root@vps2:~# route -n  
    Kernel IP routing table  
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface  
    92.222.32.0     0.0.0.0         255.255.255.0   U     0      0        0 venet0  
    0.0.0.0         92.222.50.49    0.0.0.0         UG    0      0        0 venet0  
    0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 venet0  
    root@vps2:~# service openvpn start  
    [ ok ] Starting virtual private network daemon: myvpn.  
    root@vps2:~# wget --no-dns-cache --no-proxy --header="Host: ipecho.net" http://146.255.36.1/plain -q -O - 2>&1;echo  
    217.23.15.239  
    root@vps2:~#   
    

    Hooray! I got this far on my own.

Now after connecting to the VPN, the routing gets changed automatically. This is nice and all, but now I lose all connectivity via my original public IP address and my SSH connection gets dropped, my web server is no longer accessible and even other services that I offer. I guess this is because all incoming connections now have responses being routed over the VPN. I would much rather see all connections that come in via my original public IP, to get responses from the same IP. And that the VPN is only be used for connections that my server initiates towards the outside world. I haven't figured out this part yet.

This is how my routing looks like after I connect to the VPN:

root@vps2:~# route -n  
Kernel IP routing table  
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface  
10.130.0.1      10.130.3.73     255.255.255.255 UGH   0      0        0 tun0  
10.130.3.73     0.0.0.0         255.255.255.255 UH    0      0        0 tun0  
217.23.15.239   92.222.32.42    255.255.255.255 UGH   0      0        0 venet0  
92.222.32.0     0.0.0.0         255.255.255.0   U     0      0        0 venet0  
0.0.0.0         10.130.3.73     128.0.0.0       UG    0      0        0 tun0  
128.0.0.0       10.130.3.73     128.0.0.0       UG    0      0        0 tun0  
0.0.0.0         92.222.32.42    0.0.0.0         UG    0      0        0 venet0  
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 venet0  
root@vps2:~#   

So my questions are:

  • What should I use as my default gateway, as both methods worked? My original public IP or the first hop in the traceroute? Or something totally different even?

  • How can I automate this, so the gateway is set automatically when booting? I mean that so on boot the server checks if I a default gateway set, and if not it will then put my public IP or the first hop of the traceroute as the default gateway...

  • And after finally connecting to the openVPN, how do I prevent losing connectivity via the original public IP address, but still have all outgoing connections use the VPN?

2

Starting at the beginning and working through your questions in order:

  1. Connection cannot be established

    The connection could be established, I would get an IP, but I could not get traffic via the VPN [...] because of the default gateway not being set

    If you can't ping the remote end of the connection you've got more important problems than wanting to change the default route. Before you look at and potential routing issues make sure you can ping the remote end. Since you haven't included even an approximation to your client configuration file I can't give you the specific command.

  2. How to change the default gateway?

    Don't change the default gateway yourself. If you want to route all your traffic over the VPN connection use the redirect-gateway def1 configuration parameter as explained in the OpenVPN HOWTO.

  3. How to start the VPN at boot time?

    This is also explained in the OpenVPN HOWTO and involves you creating the appropriate configuration file in /etc/openvpn (and on Debian derived systems editing /etc/default/openvpn to activate autostart).

  4. How to avoid losing other Internet connectivity

    After finally connecting to the openVPN, the default gateway is changed to use the openVPN. Any existing connection however (for example my SSH connection) gets cut off, and the machine is no longer reachable from the internet. Can I prevent this behavior?

    If you're routing all traffic across the VPN you can't arbitrarily choose to have some of it routed over the Internet. You probably need to rethink your criteria for routing "all" traffic over the VPN. Could this be "just HTTP/HTTPS traffic", "everything except SSH", for example?

  • @nl-x what you've written doesn't say that at all. For example "The connection could be established [...but...] I could not get traffic via the VPN.". If your connection has been established you must have a route to the server. – roaima Dec 1 '16 at 8:28
  • @nl-x with the description in your comment the connection has not necessarily been established.Please make up your mind. – roaima Dec 1 '16 at 10:06
  • I just rewrote my entire question, hoping to have made it much more clear. – nl-x Dec 1 '16 at 10:24
  • @nl-x that's much clearer, thank you. To allow established connections to continue despite the VPN you will need to create an alternative route table, use iptables to mark outgoing traffic that's RELATED or ESTABLISHED, and add a routing rule to force the kernel to use the alternate routing table when the packet is marked. – roaima Dec 1 '16 at 10:29
  • Thanks, I think that is indeed where I should head. Can you please help me out in doing so? I think I understand what you mean, but I have to clue as how to do it. – nl-x Dec 1 '16 at 10:53
1

The venet in your routes makes me think you're running on something like OpenVZ?

If so, you'll probably need, on the hypervisor, to load the tun module, and allow your guest to use it. Assuming you are using OpenVZ, this would look like:

vz# modprobe tun && echo tun >>/etc/modules
vz# vzctl set $CTID --devnodes net/tun:rw --capability net_admin:on --save
  • I have no clue on what venet means. All I know is that this 'machine' is a paid VPS. I don't have access to the bare metal. – nl-x Dec 1 '16 at 7:15
  • If you do not have access to the parent server, then you may try asking your provider for help troubleshooting this, he'll know better what he can/could/may/won't do. – SYN Dec 2 '16 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.